@alneas/eaos-server 0.0.0-stage → 0.1.0

package/dist/chunk-5WOZWPZA.js

@@ -0,0 +1,211 @@
+// src/db-package/migration/aggregator.ts
+import { resolveDataContracts } from "@alneas/eaos-core/contracts/data-contracts";
+var MigrationAggregator = class {
+  /**
+   * Captures plugin manifests and available data contracts for later collection.
+   * @param plugins - Manifests consulted on every collection call; the array is retained rather than cloned.
+   * @param dataContracts - Available contracts used to resolve manifest requirements; defaults to none and is retained.
+   */
+  constructor(plugins, dataContracts = []) {
+    this.plugins = plugins;
+    this.dataContracts = dataContracts;
+  }
+  plugins;
+  dataContracts;
+  /**
+   * Collects resolved data contracts first, then plugin and extension schemas by migration order.
+   * @param resolveSchema - Called with plugin ID and optional extension ID; returns a legacy schema or null to skip it. Plugin schemas declaring data contracts skip the plugin-level callback, but extensions are still resolved.
+   * @returns Ordered schema sources; manifests with equal order retain their sort order and missing callback results are omitted.
+   * @throws Propagates contract resolution or callback errors.
+   * @example
+   * ```typescript
+   * import { MigrationAggregator } from "@alneas/eaos-server/db/migration/aggregator";
+   * const aggregator = new MigrationAggregator([]);
+   * console.log(aggregator.collectSchemas(() => null)); // []
+   * ```
+   */
+  collectSchemas(resolveSchema) {
+    const sources = [];
+    const requirements = {};
+    for (const plugin of this.plugins) {
+      resolveDataContracts(this.dataContracts, plugin.schema.dataContracts ?? {});
+      Object.assign(requirements, plugin.schema.dataContracts ?? {});
+    }
+    for (const contract of resolveDataContracts(this.dataContracts, requirements).contracts) sources.push({ pluginId: `data:${contract.id}`, pluginName: contract.description, schemaJson: contract.schema });
+    const sorted = [...this.plugins].sort(
+      (a, b) => (a.schema?.migrationOrder ?? 999) - (b.schema?.migrationOrder ?? 999)
+    );
+    for (const plugin of sorted) {
+      const schemaJson = Object.keys(plugin.schema.dataContracts ?? {}).length ? null : resolveSchema(plugin.id);
+      if (schemaJson) {
+        sources.push({
+          pluginId: plugin.id,
+          pluginName: plugin.name,
+          migrationOrder: plugin.schema?.migrationOrder ?? 999,
+          schemaJson
+        });
+      }
+      if (plugin.extensions) {
+        for (const ext of plugin.extensions) {
+          const extSchemaJson = resolveSchema(plugin.id, ext.id);
+          if (extSchemaJson) {
+            sources.push({
+              pluginId: plugin.id,
+              pluginName: plugin.name,
+              extensionId: ext.id,
+              migrationOrder: plugin.schema?.migrationOrder ?? 999,
+              schemaJson: extSchemaJson
+            });
+          }
+        }
+      }
+    }
+    return sources;
+  }
+  /**
+   * Renders PostgreSQL table DDL and tenant_id row-level-security policies as text.
+   * @param sources - Trusted legacy schemas rendered in supplied order. Every table must declare tenant_id not explicitly nullable.
+   * @param dbDriver - Label included in SQL comments only; defaults to postgres and does not change dialect.
+   * @returns SQL text with a generated timestamp, CREATE TABLE IF NOT EXISTS, and tenant policies using app.current_tenant as UUID.
+   * @throws For canonical x-db/$defs schemas or missing/nullable tenant_id columns.
+   * @remarks The host must set app.current_tenant appropriately and review/apply SQL separately.
+   * @example
+   * ```typescript
+   * import { MigrationAggregator } from "@alneas/eaos-server/db/migration/aggregator";
+   * const aggregator = new MigrationAggregator([]);
+   * console.log(aggregator.generatePostgres([]));
+   * ```
+   */
+  generatePostgres(sources, dbDriver = "postgres") {
+    let sqlOutput = `-- Auto-generated Supabase / PostgreSQL DDL & RLS Policies
+`;
+    sqlOutput += `-- Driver: ${dbDriver}
+-- Generated at: ${(/* @__PURE__ */ new Date()).toISOString()}
+
+`;
+    for (const source of sources) {
+      const identifier = source.extensionId ? `${source.pluginId}:${source.extensionId}` : source.pluginId;
+      sqlOutput += `-- ==========================================
+`;
+      sqlOutput += `-- Plugin: ${source.pluginName || source.pluginId} (source: ${identifier})
+`;
+      sqlOutput += `-- Migration Order: ${source.migrationOrder ?? 999}
+`;
+      sqlOutput += `-- ==========================================
+
+`;
+      sqlOutput += this.convertJsonSchemaToPostgresSql(identifier, source.schemaJson);
+    }
+    return sqlOutput;
+  }
+  /**
+   * Renders legacy Oracle table DDL as text.
+   * @param sources - Trusted legacy schemas rendered in supplied order; every table must declare tenant_id not explicitly nullable.
+   * @returns SQL text with a generated timestamp and CREATE TABLE statements; no VPD policies or default clauses are emitted by this converter.
+   * @throws For canonical x-db/$defs schemas or missing/nullable tenant_id columns.
+   * @remarks Applying SQL and enforcing Oracle tenant isolation remain host responsibilities.
+   * @example
+   * ```typescript
+   * import { MigrationAggregator } from "@alneas/eaos-server/db/migration/aggregator";
+   * const aggregator = new MigrationAggregator([]);
+   * console.log(aggregator.generateOracle([]));
+   * ```
+   */
+  generateOracle(sources) {
+    let sqlOutput = `-- Auto-generated Oracle ADB DDL & VPD Context Policies
+`;
+    sqlOutput += `-- Driver: ORACLE
+-- Generated at: ${(/* @__PURE__ */ new Date()).toISOString()}
+
+`;
+    for (const source of sources) {
+      const identifier = source.extensionId ? `${source.pluginId}:${source.extensionId}` : source.pluginId;
+      sqlOutput += `-- ==========================================
+`;
+      sqlOutput += `-- Plugin: ${source.pluginName || source.pluginId} (source: ${identifier})
+`;
+      sqlOutput += `-- Migration Order: ${source.migrationOrder ?? 999}
+`;
+      sqlOutput += `-- ==========================================
+
+`;
+      sqlOutput += this.convertJsonSchemaToOracleSql(identifier, source.schemaJson);
+    }
+    return sqlOutput;
+  }
+  convertJsonSchemaToPostgresSql(_identifier, schemaJson) {
+    let sql = "";
+    if (schemaJson["x-db"] || schemaJson.$defs) throw new Error("Use the data contract reviewed lifecycle migrations for canonical JSON Schema");
+    const tables = schemaJson.tables || {};
+    for (const [tableName, tableDef] of Object.entries(tables)) {
+      sql += `CREATE TABLE IF NOT EXISTS ${tableName} (
+`;
+      const columnDefs = [];
+      const columns = tableDef.columns || {};
+      assertTenantColumn(tableName, columns);
+      for (const [colName, colDef] of Object.entries(columns)) {
+        let colType = "TEXT";
+        const rawType = (colDef.type || "").toUpperCase();
+        if (rawType === "UUID") colType = "UUID";
+        else if (rawType.includes("VARCHAR")) colType = "VARCHAR(255)";
+        else if (rawType.includes("NUMBER") || rawType.includes("DECIMAL")) colType = "NUMERIC(18,2)";
+        else if (rawType.includes("TIMESTAMP") || rawType.includes("DATE")) colType = "TIMESTAMPTZ";
+        else if (rawType.includes("INT")) colType = "BIGINT";
+        let line = `  ${colName} ${colType}`;
+        if (colDef.primaryKey) line += " PRIMARY KEY";
+        if (colDef.nullable === false) line += " NOT NULL";
+        if (colDef.default) line += ` DEFAULT ${colDef.default}`;
+        columnDefs.push(line);
+      }
+      sql += columnDefs.join(",\n") + "\n);\n\n";
+      if (columns["tenant_id"]) {
+        sql += `-- Supabase Row Level Security (RLS) for ${tableName}
+`;
+        sql += `ALTER TABLE ${tableName} ENABLE ROW LEVEL SECURITY;
+`;
+        sql += `DROP POLICY IF EXISTS ${tableName}_tenant_isolation ON ${tableName};
+`;
+        sql += `CREATE POLICY ${tableName}_tenant_isolation ON ${tableName} FOR ALL USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+`;
+      }
+    }
+    return sql;
+  }
+  convertJsonSchemaToOracleSql(_identifier, schemaJson) {
+    let sql = "";
+    if (schemaJson["x-db"] || schemaJson.$defs) throw new Error("Use the data contract reviewed lifecycle migrations for canonical JSON Schema");
+    const tables = schemaJson.tables || {};
+    for (const [tableName, tableDef] of Object.entries(tables)) {
+      sql += `CREATE TABLE ${tableName} (
+`;
+      const columnDefs = [];
+      const columns = tableDef.columns || {};
+      assertTenantColumn(tableName, columns);
+      for (const [colName, colDef] of Object.entries(columns)) {
+        let colType = "VARCHAR2(255)";
+        const rawType = (colDef.type || "").toUpperCase();
+        if (rawType === "UUID") colType = "VARCHAR2(36)";
+        else if (rawType.includes("VARCHAR")) colType = "VARCHAR2(255)";
+        else if (rawType.includes("NUMBER") || rawType.includes("DECIMAL")) colType = "NUMBER(18,2)";
+        else if (rawType.includes("TIMESTAMP") || rawType.includes("DATE")) colType = "TIMESTAMP WITH TIME ZONE";
+        else if (rawType.includes("INT")) colType = "NUMBER(19)";
+        let line = `  ${colName} ${colType}`;
+        if (colDef.primaryKey) line += " PRIMARY KEY";
+        if (colDef.nullable === false) line += " NOT NULL";
+        columnDefs.push(line);
+      }
+      sql += columnDefs.join(",\n") + "\n);\n\n";
+    }
+    return sql;
+  }
+};
+function assertTenantColumn(tableName, columns) {
+  const tenant = columns.tenant_id;
+  if (!tenant || tenant.nullable === true) throw new Error(`Schema table ${tableName} must declare a non-null tenant_id column`);
+}
+
+export {
+  MigrationAggregator
+};
+//# sourceMappingURL=chunk-5WOZWPZA.js.map

package/dist/chunk-5WOZWPZA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db-package/migration/aggregator.ts"],"sourcesContent":["import { resolveDataContracts, type DataContract } from '@alneas/eaos-core/contracts/data-contracts'\nimport type { PluginManifest } from '@alneas/eaos-core/plugin-sdk/types'\n\n/**\n * Legacy table-schema input collected for migration text generation.\n * @see MigrationAggregator for a complete usage example.\n */\nexport interface SchemaSource {\n  /** Plugin ID, or data:{contractId} for resolved data contracts. */\n  pluginId: string\n  /** Optional display label used in generated SQL comments. */\n  pluginName?: string\n  /** Optional extension ID appended to the source identifier. */\n  extensionId?: string\n  /** Sort order from the plugin manifest; defaults to 999 for plugin schemas. */\n  migrationOrder?: number\n  /** Legacy tables/columns schema; canonical x-db/$defs schemas require reviewed lifecycle migrations instead. */\n  schemaJson: Record<string, any>\n}\n\n/**\n * Collects plugin schema sources and renders legacy PostgreSQL or Oracle DDL text.\n * @remarks Generation never executes SQL. Schema identifiers, defaults, and comments are interpolated from trusted schema inputs; review generated SQL before applying it. Canonical data-contract JSON Schema requires reviewed lifecycle migrations rather than these legacy converters.\n * @example\n * ```typescript\n * import { MigrationAggregator } from \"@alneas/eaos-server/db/migration/aggregator\";\n * const aggregator = new MigrationAggregator([]);\n * console.log(aggregator.generatePostgres([]));\n * ```\n */\nexport class MigrationAggregator {\n  /**\n   * Captures plugin manifests and available data contracts for later collection.\n   * @param plugins - Manifests consulted on every collection call; the array is retained rather than cloned.\n   * @param dataContracts - Available contracts used to resolve manifest requirements; defaults to none and is retained.\n   */\n  constructor(private plugins: PluginManifest[], private dataContracts: DataContract[] = []) {}\n\n  /**\n   * Collects resolved data contracts first, then plugin and extension schemas by migration order.\n   * @param resolveSchema - Called with plugin ID and optional extension ID; returns a legacy schema or null to skip it. Plugin schemas declaring data contracts skip the plugin-level callback, but extensions are still resolved.\n   * @returns Ordered schema sources; manifests with equal order retain their sort order and missing callback results are omitted.\n   * @throws Propagates contract resolution or callback errors.\n   * @example\n   * ```typescript\n   * import { MigrationAggregator } from \"@alneas/eaos-server/db/migration/aggregator\";\n   * const aggregator = new MigrationAggregator([]);\n   * console.log(aggregator.collectSchemas(() => null)); // []\n   * ```\n   */\n  collectSchemas(\n    resolveSchema: (pluginId: string, extensionId?: string) => Record<string, any> | null\n  ): SchemaSource[] {\n    const sources: SchemaSource[] = []\n    const requirements: Record<string, string> = {}\n    for (const plugin of this.plugins) {\n      resolveDataContracts(this.dataContracts, plugin.schema.dataContracts ?? {})\n      Object.assign(requirements, plugin.schema.dataContracts ?? {})\n    }\n    for (const contract of resolveDataContracts(this.dataContracts, requirements).contracts) sources.push({ pluginId: `data:${contract.id}`, pluginName: contract.description, schemaJson: contract.schema })\n    const sorted = [...this.plugins].sort(\n      (a, b) => (a.schema?.migrationOrder ?? 999) - (b.schema?.migrationOrder ?? 999)\n    )\n\n    for (const plugin of sorted) {\n      const schemaJson = Object.keys(plugin.schema.dataContracts ?? {}).length ? null : resolveSchema(plugin.id)\n      if (schemaJson) {\n        sources.push({\n          pluginId: plugin.id,\n          pluginName: plugin.name,\n          migrationOrder: plugin.schema?.migrationOrder ?? 999,\n          schemaJson,\n        })\n      }\n\n      if (plugin.extensions) {\n        for (const ext of plugin.extensions) {\n          const extSchemaJson = resolveSchema(plugin.id, ext.id)\n          if (extSchemaJson) {\n            sources.push({\n              pluginId: plugin.id,\n              pluginName: plugin.name,\n              extensionId: ext.id,\n              migrationOrder: plugin.schema?.migrationOrder ?? 999,\n              schemaJson: extSchemaJson,\n            })\n          }\n        }\n      }\n    }\n    return sources\n  }\n\n  /**\n   * Renders PostgreSQL table DDL and tenant_id row-level-security policies as text.\n   * @param sources - Trusted legacy schemas rendered in supplied order. Every table must declare tenant_id not explicitly nullable.\n   * @param dbDriver - Label included in SQL comments only; defaults to postgres and does not change dialect.\n   * @returns SQL text with a generated timestamp, CREATE TABLE IF NOT EXISTS, and tenant policies using app.current_tenant as UUID.\n   * @throws For canonical x-db/$defs schemas or missing/nullable tenant_id columns.\n   * @remarks The host must set app.current_tenant appropriately and review/apply SQL separately.\n   * @example\n   * ```typescript\n   * import { MigrationAggregator } from \"@alneas/eaos-server/db/migration/aggregator\";\n   * const aggregator = new MigrationAggregator([]);\n   * console.log(aggregator.generatePostgres([]));\n   * ```\n   */\n  generatePostgres(sources: SchemaSource[], dbDriver: string = 'postgres'): string {\n    let sqlOutput = `-- Auto-generated Supabase / PostgreSQL DDL & RLS Policies\\n`\n    sqlOutput += `-- Driver: ${dbDriver}\\n-- Generated at: ${new Date().toISOString()}\\n\\n`\n\n    for (const source of sources) {\n      const identifier = source.extensionId ? `${source.pluginId}:${source.extensionId}` : source.pluginId\n      sqlOutput += `-- ==========================================\\n`\n      sqlOutput += `-- Plugin: ${source.pluginName || source.pluginId} (source: ${identifier})\\n`\n      sqlOutput += `-- Migration Order: ${source.migrationOrder ?? 999}\\n`\n      sqlOutput += `-- ==========================================\\n\\n`\n\n      sqlOutput += this.convertJsonSchemaToPostgresSql(identifier, source.schemaJson)\n    }\n\n    return sqlOutput\n  }\n\n  /**\n   * Renders legacy Oracle table DDL as text.\n   * @param sources - Trusted legacy schemas rendered in supplied order; every table must declare tenant_id not explicitly nullable.\n   * @returns SQL text with a generated timestamp and CREATE TABLE statements; no VPD policies or default clauses are emitted by this converter.\n   * @throws For canonical x-db/$defs schemas or missing/nullable tenant_id columns.\n   * @remarks Applying SQL and enforcing Oracle tenant isolation remain host responsibilities.\n   * @example\n   * ```typescript\n   * import { MigrationAggregator } from \"@alneas/eaos-server/db/migration/aggregator\";\n   * const aggregator = new MigrationAggregator([]);\n   * console.log(aggregator.generateOracle([]));\n   * ```\n   */\n  generateOracle(sources: SchemaSource[]): string {\n    let sqlOutput = `-- Auto-generated Oracle ADB DDL & VPD Context Policies\\n`\n    sqlOutput += `-- Driver: ORACLE\\n-- Generated at: ${new Date().toISOString()}\\n\\n`\n\n    for (const source of sources) {\n      const identifier = source.extensionId ? `${source.pluginId}:${source.extensionId}` : source.pluginId\n      sqlOutput += `-- ==========================================\\n`\n      sqlOutput += `-- Plugin: ${source.pluginName || source.pluginId} (source: ${identifier})\\n`\n      sqlOutput += `-- Migration Order: ${source.migrationOrder ?? 999}\\n`\n      sqlOutput += `-- ==========================================\\n\\n`\n\n      sqlOutput += this.convertJsonSchemaToOracleSql(identifier, source.schemaJson)\n    }\n\n    return sqlOutput\n  }\n\n  private convertJsonSchemaToPostgresSql(_identifier: string, schemaJson: any): string {\n    let sql = ''\n    if (schemaJson['x-db'] || schemaJson.$defs) throw new Error('Use the data contract reviewed lifecycle migrations for canonical JSON Schema')\n    const tables = schemaJson.tables || {}\n\n    for (const [tableName, tableDef] of Object.entries<any>(tables)) {\n      sql += `CREATE TABLE IF NOT EXISTS ${tableName} (\\n`\n      const columnDefs: string[] = []\n      const columns = tableDef.columns || {}\n      assertTenantColumn(tableName, columns)\n\n      for (const [colName, colDef] of Object.entries<any>(columns)) {\n        let colType = 'TEXT'\n        const rawType = (colDef.type || '').toUpperCase()\n\n        if (rawType === 'UUID') colType = 'UUID'\n        else if (rawType.includes('VARCHAR')) colType = 'VARCHAR(255)'\n        else if (rawType.includes('NUMBER') || rawType.includes('DECIMAL')) colType = 'NUMERIC(18,2)'\n        else if (rawType.includes('TIMESTAMP') || rawType.includes('DATE')) colType = 'TIMESTAMPTZ'\n        else if (rawType.includes('INT')) colType = 'BIGINT'\n\n        let line = `  ${colName} ${colType}`\n        if (colDef.primaryKey) line += ' PRIMARY KEY'\n        if (colDef.nullable === false) line += ' NOT NULL'\n        if (colDef.default) line += ` DEFAULT ${colDef.default}`\n\n        columnDefs.push(line)\n      }\n\n      sql += columnDefs.join(',\\n') + '\\n);\\n\\n'\n\n      if (columns['tenant_id']) {\n        sql += `-- Supabase Row Level Security (RLS) for ${tableName}\\n`\n        sql += `ALTER TABLE ${tableName} ENABLE ROW LEVEL SECURITY;\\n`\n        sql += `DROP POLICY IF EXISTS ${tableName}_tenant_isolation ON ${tableName};\\n`\n        sql += `CREATE POLICY ${tableName}_tenant_isolation ON ${tableName} FOR ALL USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);\\n\\n`\n      }\n    }\n\n    return sql\n  }\n\n  private convertJsonSchemaToOracleSql(_identifier: string, schemaJson: any): string {\n    let sql = ''\n    if (schemaJson['x-db'] || schemaJson.$defs) throw new Error('Use the data contract reviewed lifecycle migrations for canonical JSON Schema')\n    const tables = schemaJson.tables || {}\n\n    for (const [tableName, tableDef] of Object.entries<any>(tables)) {\n      sql += `CREATE TABLE ${tableName} (\\n`\n      const columnDefs: string[] = []\n      const columns = tableDef.columns || {}\n      assertTenantColumn(tableName, columns)\n\n      for (const [colName, colDef] of Object.entries<any>(columns)) {\n        let colType = 'VARCHAR2(255)'\n        const rawType = (colDef.type || '').toUpperCase()\n\n        if (rawType === 'UUID') colType = 'VARCHAR2(36)'\n        else if (rawType.includes('VARCHAR')) colType = 'VARCHAR2(255)'\n        else if (rawType.includes('NUMBER') || rawType.includes('DECIMAL')) colType = 'NUMBER(18,2)'\n        else if (rawType.includes('TIMESTAMP') || rawType.includes('DATE')) colType = 'TIMESTAMP WITH TIME ZONE'\n        else if (rawType.includes('INT')) colType = 'NUMBER(19)'\n\n        let line = `  ${colName} ${colType}`\n        if (colDef.primaryKey) line += ' PRIMARY KEY'\n        if (colDef.nullable === false) line += ' NOT NULL'\n\n        columnDefs.push(line)\n      }\n\n      sql += columnDefs.join(',\\n') + '\\n);\\n\\n'\n    }\n\n    return sql\n  }\n}\n\nfunction assertTenantColumn(tableName: string, columns: Record<string, any>): void {\n  const tenant = columns.tenant_id\n  if (!tenant || tenant.nullable === true) throw new Error(`Schema table ${tableName} must declare a non-null tenant_id column`)\n}\n"],"mappings":";AAAA,SAAS,4BAA+C;AA8BjD,IAAM,sBAAN,MAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/B,YAAoB,SAAmC,gBAAgC,CAAC,GAAG;AAAvE;AAAmC;AAAA,EAAqC;AAAA,EAAxE;AAAA,EAAmC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcvD,eACE,eACgB;AAChB,UAAM,UAA0B,CAAC;AACjC,UAAM,eAAuC,CAAC;AAC9C,eAAW,UAAU,KAAK,SAAS;AACjC,2BAAqB,KAAK,eAAe,OAAO,OAAO,iBAAiB,CAAC,CAAC;AAC1E,aAAO,OAAO,cAAc,OAAO,OAAO,iBAAiB,CAAC,CAAC;AAAA,IAC/D;AACA,eAAW,YAAY,qBAAqB,KAAK,eAAe,YAAY,EAAE,UAAW,SAAQ,KAAK,EAAE,UAAU,QAAQ,SAAS,EAAE,IAAI,YAAY,SAAS,aAAa,YAAY,SAAS,OAAO,CAAC;AACxM,UAAM,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE;AAAA,MAC/B,CAAC,GAAG,OAAO,EAAE,QAAQ,kBAAkB,QAAQ,EAAE,QAAQ,kBAAkB;AAAA,IAC7E;AAEA,eAAW,UAAU,QAAQ;AAC3B,YAAM,aAAa,OAAO,KAAK,OAAO,OAAO,iBAAiB,CAAC,CAAC,EAAE,SAAS,OAAO,cAAc,OAAO,EAAE;AACzG,UAAI,YAAY;AACd,gBAAQ,KAAK;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,YAAY,OAAO;AAAA,UACnB,gBAAgB,OAAO,QAAQ,kBAAkB;AAAA,UACjD;AAAA,QACF,CAAC;AAAA,MACH;AAEA,UAAI,OAAO,YAAY;AACrB,mBAAW,OAAO,OAAO,YAAY;AACnC,gBAAM,gBAAgB,cAAc,OAAO,IAAI,IAAI,EAAE;AACrD,cAAI,eAAe;AACjB,oBAAQ,KAAK;AAAA,cACX,UAAU,OAAO;AAAA,cACjB,YAAY,OAAO;AAAA,cACnB,aAAa,IAAI;AAAA,cACjB,gBAAgB,OAAO,QAAQ,kBAAkB;AAAA,cACjD,YAAY;AAAA,YACd,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,iBAAiB,SAAyB,WAAmB,YAAoB;AAC/E,QAAI,YAAY;AAAA;AAChB,iBAAa,cAAc,QAAQ;AAAA,oBAAsB,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA;AAAA;AAEjF,eAAW,UAAU,SAAS;AAC5B,YAAM,aAAa,OAAO,cAAc,GAAG,OAAO,QAAQ,IAAI,OAAO,WAAW,KAAK,OAAO;AAC5F,mBAAa;AAAA;AACb,mBAAa,cAAc,OAAO,cAAc,OAAO,QAAQ,aAAa,UAAU;AAAA;AACtF,mBAAa,uBAAuB,OAAO,kBAAkB,GAAG;AAAA;AAChE,mBAAa;AAAA;AAAA;AAEb,mBAAa,KAAK,+BAA+B,YAAY,OAAO,UAAU;AAAA,IAChF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,eAAe,SAAiC;AAC9C,QAAI,YAAY;AAAA;AAChB,iBAAa;AAAA,oBAAuC,oBAAI,KAAK,GAAE,YAAY,CAAC;AAAA;AAAA;AAE5E,eAAW,UAAU,SAAS;AAC5B,YAAM,aAAa,OAAO,cAAc,GAAG,OAAO,QAAQ,IAAI,OAAO,WAAW,KAAK,OAAO;AAC5F,mBAAa;AAAA;AACb,mBAAa,cAAc,OAAO,cAAc,OAAO,QAAQ,aAAa,UAAU;AAAA;AACtF,mBAAa,uBAAuB,OAAO,kBAAkB,GAAG;AAAA;AAChE,mBAAa;AAAA;AAAA;AAEb,mBAAa,KAAK,6BAA6B,YAAY,OAAO,UAAU;AAAA,IAC9E;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,+BAA+B,aAAqB,YAAyB;AACnF,QAAI,MAAM;AACV,QAAI,WAAW,MAAM,KAAK,WAAW,MAAO,OAAM,IAAI,MAAM,+EAA+E;AAC3I,UAAM,SAAS,WAAW,UAAU,CAAC;AAErC,eAAW,CAAC,WAAW,QAAQ,KAAK,OAAO,QAAa,MAAM,GAAG;AAC/D,aAAO,8BAA8B,SAAS;AAAA;AAC9C,YAAM,aAAuB,CAAC;AAC9B,YAAM,UAAU,SAAS,WAAW,CAAC;AACrC,yBAAmB,WAAW,OAAO;AAErC,iBAAW,CAAC,SAAS,MAAM,KAAK,OAAO,QAAa,OAAO,GAAG;AAC5D,YAAI,UAAU;AACd,cAAM,WAAW,OAAO,QAAQ,IAAI,YAAY;AAEhD,YAAI,YAAY,OAAQ,WAAU;AAAA,iBACzB,QAAQ,SAAS,SAAS,EAAG,WAAU;AAAA,iBACvC,QAAQ,SAAS,QAAQ,KAAK,QAAQ,SAAS,SAAS,EAAG,WAAU;AAAA,iBACrE,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,MAAM,EAAG,WAAU;AAAA,iBACrE,QAAQ,SAAS,KAAK,EAAG,WAAU;AAE5C,YAAI,OAAO,KAAK,OAAO,IAAI,OAAO;AAClC,YAAI,OAAO,WAAY,SAAQ;AAC/B,YAAI,OAAO,aAAa,MAAO,SAAQ;AACvC,YAAI,OAAO,QAAS,SAAQ,YAAY,OAAO,OAAO;AAEtD,mBAAW,KAAK,IAAI;AAAA,MACtB;AAEA,aAAO,WAAW,KAAK,KAAK,IAAI;AAEhC,UAAI,QAAQ,WAAW,GAAG;AACxB,eAAO,4CAA4C,SAAS;AAAA;AAC5D,eAAO,eAAe,SAAS;AAAA;AAC/B,eAAO,yBAAyB,SAAS,wBAAwB,SAAS;AAAA;AAC1E,eAAO,iBAAiB,SAAS,wBAAwB,SAAS;AAAA;AAAA;AAAA,MACpE;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,6BAA6B,aAAqB,YAAyB;AACjF,QAAI,MAAM;AACV,QAAI,WAAW,MAAM,KAAK,WAAW,MAAO,OAAM,IAAI,MAAM,+EAA+E;AAC3I,UAAM,SAAS,WAAW,UAAU,CAAC;AAErC,eAAW,CAAC,WAAW,QAAQ,KAAK,OAAO,QAAa,MAAM,GAAG;AAC/D,aAAO,gBAAgB,SAAS;AAAA;AAChC,YAAM,aAAuB,CAAC;AAC9B,YAAM,UAAU,SAAS,WAAW,CAAC;AACrC,yBAAmB,WAAW,OAAO;AAErC,iBAAW,CAAC,SAAS,MAAM,KAAK,OAAO,QAAa,OAAO,GAAG;AAC5D,YAAI,UAAU;AACd,cAAM,WAAW,OAAO,QAAQ,IAAI,YAAY;AAEhD,YAAI,YAAY,OAAQ,WAAU;AAAA,iBACzB,QAAQ,SAAS,SAAS,EAAG,WAAU;AAAA,iBACvC,QAAQ,SAAS,QAAQ,KAAK,QAAQ,SAAS,SAAS,EAAG,WAAU;AAAA,iBACrE,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,MAAM,EAAG,WAAU;AAAA,iBACrE,QAAQ,SAAS,KAAK,EAAG,WAAU;AAE5C,YAAI,OAAO,KAAK,OAAO,IAAI,OAAO;AAClC,YAAI,OAAO,WAAY,SAAQ;AAC/B,YAAI,OAAO,aAAa,MAAO,SAAQ;AAEvC,mBAAW,KAAK,IAAI;AAAA,MACtB;AAEA,aAAO,WAAW,KAAK,KAAK,IAAI;AAAA,IAClC;AAEA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,WAAmB,SAAoC;AACjF,QAAM,SAAS,QAAQ;AACvB,MAAI,CAAC,UAAU,OAAO,aAAa,KAAM,OAAM,IAAI,MAAM,gBAAgB,SAAS,2CAA2C;AAC/H;","names":[]}

package/dist/chunk-6CBVZ6CT.js

@@ -0,0 +1,168 @@
+// src/lifecycle-engine/platform/deployment.ts
+var deploymentComponentKinds = ["frontend", "api", "mcp", "service", "function", "worker", "job", "webhook", "workflow", "database", "infrastructure", "storage", "cache", "queue", "search", "integration", "native", "model", "data-import"];
+var deploymentActions = ["build", "test", "preview", "provision", "configure", "migrate", "deploy", "verify", "import", "enable"];
+function object(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function nonempty(value) {
+  return typeof value === "string" && !!value.trim() && value === value.trim();
+}
+function id(value) {
+  return nonempty(value) && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value);
+}
+function strings(value, allowEmpty = true) {
+  return Array.isArray(value) && (allowEmpty || !!value.length) && value.every(nonempty) && new Set(value).size === value.length;
+}
+function fields(value, allowed) {
+  if (Object.keys(value).some((key) => !allowed.includes(key))) throw new Error("Unknown deployment declaration field");
+}
+function mapping(value) {
+  return object(value) && Object.entries(value).every(([key, v]) => nonempty(key) && nonempty(v));
+}
+function targetKey(target) {
+  return JSON.stringify([target?.environment ?? null, target?.backendId ?? null, target?.databaseId ?? null, target?.tenantId ?? null]);
+}
+function validateDeploymentPlugins(inventory) {
+  if (inventory.plugins === void 0) return void 0;
+  if (!Array.isArray(inventory.plugins) || !inventory.plugins.length || !strings(inventory.lifecycleBundle, false) || inventory.plugins.length !== inventory.lifecycleBundle.length) throw new Error("Deployment plugins must cover the lifecycle bundle");
+  const pluginIds = /* @__PURE__ */ new Set(), assets = new Set(inventory.assets.map((asset) => asset.path));
+  for (const plugin of inventory.plugins) {
+    if (!object(plugin) || !id(plugin.id) || pluginIds.has(plugin.id) || !inventory.lifecycleBundle.includes(plugin.id) || !Array.isArray(plugin.components) || !Array.isArray(plugin.tasks)) throw new Error("Invalid or duplicate deployment plugin");
+    fields(plugin, ["id", "components", "tasks"]);
+    pluginIds.add(plugin.id);
+    const components = /* @__PURE__ */ new Set(), tasks = /* @__PURE__ */ new Map();
+    for (const component of plugin.components) {
+      if (!object(component) || !id(component.id) || components.has(component.id) || !deploymentComponentKinds.includes(component.kind) || component.required !== void 0 && typeof component.required !== "boolean" || !["host", "container", "function", "database", "cloud", "native", "external"].includes(component.placement) || component.runtime !== void 0 && !nonempty(component.runtime) || component.assets !== void 0 && (!strings(component.assets) || component.assets.some((path) => !assets.has(path))) || component.assetPatterns !== void 0 && (!strings(component.assetPatterns, false) || component.assetPatterns.some((pattern) => pattern.startsWith("/") || pattern.includes("\\") || pattern.split("/").some((part) => !part || part === "." || part === ".."))) || component.entry !== void 0 && (!nonempty(component.entry) || !assets.has(component.entry)) || component.dataContracts !== void 0 && !mapping(component.dataContracts)) throw new Error("Invalid deployment component or unverified asset reference");
+      fields(component, ["id", "kind", "required", "placement", "runtime", "assets", "assetPatterns", "entry", "dataContracts", "requirements"]);
+      if (component.requirements !== void 0) {
+        const req = component.requirements;
+        if (!object(req) || req.tools !== void 0 && !mapping(req.tools) || req.bindings !== void 0 && (!strings(req.bindings) || req.bindings.some((key) => !/^[A-Z][A-Z0-9_]*$/.test(key))) || req.adapters !== void 0 && !strings(req.adapters)) throw new Error("Invalid deployment requirements; declare references, not secret values");
+        fields(req, ["tools", "bindings", "adapters"]);
+      }
+      components.add(component.id);
+    }
+    for (const task of plugin.tasks) {
+      if (!object(task) || !id(task.id) || tasks.has(task.id) || !strings(task.componentIds, false) || task.componentIds.some((ref) => !components.has(ref)) || !deploymentActions.includes(task.action) || !["artifact", "environment", "tenant"].includes(task.scope) || typeof task.required !== "boolean" || !strings(task.dependsOn) || !nonempty(task.executor) || task.argv !== void 0 && (!Array.isArray(task.argv) || !task.argv.length || task.argv.some((arg) => typeof arg !== "string")) || task.instructions !== void 0 && !nonempty(task.instructions)) throw new Error("Invalid deployment task or component reference");
+      fields(task, ["id", "componentIds", "action", "scope", "required", "dependsOn", "executor", "argv", "instructions"]);
+      if (task.scope === "artifact" && !["build", "test", "verify"].includes(task.action)) throw new Error("Environment-changing work cannot have artifact scope");
+      tasks.set(task.id, task);
+    }
+    const visiting = /* @__PURE__ */ new Set(), visited = /* @__PURE__ */ new Set(), scopeRank = { artifact: 0, environment: 1, tenant: 2 };
+    const visit = (task) => {
+      if (visiting.has(task.id)) throw new Error("Cyclic deployment task dependency");
+      if (visited.has(task.id)) return;
+      visiting.add(task.id);
+      for (const ref of task.dependsOn) {
+        const dependency = tasks.get(ref);
+        if (!dependency) throw new Error("Unknown deployment task dependency");
+        if (scopeRank[dependency.scope] > scopeRank[task.scope]) throw new Error("Deployment dependency has a narrower target scope");
+        visit(dependency);
+      }
+      visiting.delete(task.id);
+      visited.add(task.id);
+    };
+    for (const task of tasks.values()) visit(task);
+    if (plugin.components.some((component) => !plugin.tasks.some((task) => (component.required === false || task.required) && task.componentIds.includes(component.id)))) throw new Error("Every required deployment component requires at least one required task; optional components still require declared work");
+    if (!components.size && tasks.size) throw new Error("Tasks require deployment components");
+  }
+  return inventory.plugins;
+}
+function validateDeploymentTarget(value) {
+  if (!object(value) || !nonempty(value.environment) || ["backendId", "databaseId", "tenantId"].some((key) => value[key] !== void 0 && !nonempty(value[key]))) throw new Error("Invalid deployment target");
+  fields(value, ["environment", "backendId", "databaseId", "tenantId"]);
+}
+function validateDeploymentReceipt(value) {
+  if (!object(value) || value.apiVersion !== 1 || !nonempty(value.owner) || typeof value.inventorySha256 !== "string" || !/^[a-f0-9]{64}$/.test(value.inventorySha256) || !Array.isArray(value.results)) throw new Error("Invalid deployment receipt");
+  fields(value, ["apiVersion", "owner", "inventorySha256", "results"]);
+  const times = /* @__PURE__ */ new Map();
+  for (const result of value.results) {
+    if (!object(result) || !id(result.pluginId) || !id(result.taskId) || !["running", "succeeded", "failed"].includes(result.status) || !nonempty(result.actor) || !strings(result.evidence, false) || !nonempty(result.recordedAt) || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(result.recordedAt) || !Number.isFinite(Date.parse(result.recordedAt)) || new Date(result.recordedAt).toISOString() !== result.recordedAt) throw new Error("Invalid deployment result; actor, timestamp and evidence are required");
+    fields(result, ["pluginId", "taskId", "target", "status", "recordedAt", "actor", "evidence", "destinationId", "placementSha256"]);
+    if (result.destinationId === void 0 !== (result.placementSha256 === void 0) || result.destinationId !== void 0 && (!id(result.destinationId) || !/^[a-f0-9]{64}$/.test(result.placementSha256))) throw Error("Placement evidence requires destinationId and placementSha256");
+    if (result.target !== void 0) validateDeploymentTarget(result.target);
+    const key = JSON.stringify([result.pluginId, result.taskId, targetKey(result.target), result.destinationId ?? null, result.placementSha256 ?? null]);
+    const time = Date.parse(result.recordedAt);
+    if (time <= (times.get(key) ?? -Infinity)) throw new Error("Deployment result timestamps must increase for each task/target");
+    times.set(key, time);
+  }
+}
+function taskTarget(task, target) {
+  if (task.scope === "artifact") return void 0;
+  if (!target || task.scope === "tenant" && !target.tenantId) return void 0;
+  const { tenantId: _tenantId, ...environment } = target;
+  return task.scope === "tenant" ? target : environment;
+}
+function summarizeDeployment(inventory, inventorySha256, receipts = [], target) {
+  if (!/^[a-f0-9]{64}$/.test(inventorySha256)) throw new Error("Invalid inventory SHA-256");
+  const plugins = validateDeploymentPlugins(inventory);
+  if (target !== void 0) validateDeploymentTarget(target);
+  const results = /* @__PURE__ */ new Map(), ignoredReceipts = [];
+  for (const receipt of receipts) {
+    validateDeploymentReceipt(receipt);
+    if (receipt.owner !== inventory.owner || receipt.inventorySha256 !== inventorySha256) {
+      ignoredReceipts.push({ owner: receipt.owner, reason: receipt.owner !== inventory.owner ? "different-owner" : "stale-inventory" });
+      continue;
+    }
+    for (const result of receipt.results) {
+      const task = plugins?.find((plugin2) => plugin2.id === result.pluginId)?.tasks.find((task2) => task2.id === result.taskId);
+      if (!task) throw new Error("Receipt references an undeclared deployment task");
+      if (result.destinationId !== void 0) {
+        if (task.scope === "artifact") throw Error("Artifact evidence must not be bound to a destination");
+        ignoredReceipts.push({ owner: receipt.owner, reason: "placement-context-required" });
+        continue;
+      }
+      if (task.scope === "artifact" && result.target !== void 0 || task.scope !== "artifact" && !result.target || task.scope === "environment" && result.target?.tenantId !== void 0 || task.scope === "tenant" && !result.target?.tenantId) throw new Error("Receipt target does not match task scope");
+      const plugin = plugins.find((plugin2) => plugin2.id === result.pluginId);
+      if (task.scope !== "artifact" && plugin.components.some((component) => component.kind === "database" && task.componentIds.includes(component.id)) && (!result.target?.backendId || !result.target.databaseId)) throw new Error("Database work requires explicit backendId and databaseId evidence");
+      const expected = taskTarget(task, target);
+      if (task.scope !== "artifact" && !expected || targetKey(result.target) !== targetKey(expected)) continue;
+      const key = JSON.stringify([result.pluginId, result.taskId]), old = results.get(key);
+      if (old && old.recordedAt === result.recordedAt && JSON.stringify(old) !== JSON.stringify(result)) throw new Error("Conflicting deployment results at the same timestamp");
+      if (!old || old.recordedAt < result.recordedAt) results.set(key, result);
+    }
+  }
+  const summaries = (plugins ?? []).map((plugin) => {
+    const artifactResolved = !plugin.components.some((component) => component.assetPatterns?.length);
+    const states = /* @__PURE__ */ new Map();
+    const status = (task) => {
+      const known = states.get(task.id);
+      if (known) return known;
+      const result = results.get(JSON.stringify([plugin.id, task.id]));
+      const dependencies = task.dependsOn.map((ref) => status(plugin.tasks.find((task2) => task2.id === ref)));
+      const blocked = dependencies.some((dependency) => dependency.status !== "succeeded");
+      const stale = result?.status === "succeeded" && dependencies.some((dependency) => dependency.result && dependency.result.recordedAt > result.recordedAt);
+      const state = { status: blocked ? "blocked" : stale ? "stale" : result?.status ?? "pending", result };
+      states.set(task.id, state);
+      return state;
+    };
+    const tasks = plugin.tasks.map((task) => ({ ...task, ...status(task) }));
+    return {
+      id: plugin.id,
+      artifactResolved,
+      complete: artifactResolved && tasks.filter((task) => task.required).every((task) => task.status === "succeeded"),
+      components: plugin.components.map((component) => ({ ...component, complete: artifactResolved && tasks.filter((task) => (component.required === false || task.required) && task.componentIds.includes(component.id)).every((task) => task.status === "succeeded") })),
+      tasks
+    };
+  });
+  return {
+    owner: inventory.owner,
+    inventorySha256,
+    target,
+    coverage: plugins ? "declared" : "legacy-unclassified",
+    artifactResolved: !!plugins && summaries.every((plugin) => plugin.artifactResolved),
+    complete: !!plugins && summaries.every((plugin) => plugin.complete),
+    plugins: summaries,
+    ignoredReceipts,
+    evidencePolicy: "Operator/host-reported evidence; not independent verification or runtime authorization"
+  };
+}
+
+export {
+  deploymentComponentKinds,
+  deploymentActions,
+  validateDeploymentPlugins,
+  validateDeploymentTarget,
+  validateDeploymentReceipt,
+  summarizeDeployment
+};
+//# sourceMappingURL=chunk-6CBVZ6CT.js.map

package/dist/chunk-6CBVZ6CT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lifecycle-engine/platform/deployment.ts"],"sourcesContent":["import type { DeploymentInventory } from './artifacts'\n\n/**\n * Supported deployment capability categories used to validate component declarations.\n * \n * @see summarizeDeployment for canonical integration usage.\n */\nexport const deploymentComponentKinds = ['frontend', 'api', 'mcp', 'service', 'function', 'worker', 'job', 'webhook', 'workflow', 'database', 'infrastructure', 'storage', 'cache', 'queue', 'search', 'integration', 'native', 'model', 'data-import'] as const\n/**\n * Supported declarative work phases; inspection never executes these actions.\n * \n * @see summarizeDeployment for canonical integration usage.\n */\nexport const deploymentActions = ['build', 'test', 'preview', 'provision', 'configure', 'migrate', 'deploy', 'verify', 'import', 'enable'] as const\n/**\n * One declared deployable capability with explicit placement and nonsecret host requirements.\n * \n * @see summarizeDeployment for canonical integration usage.\n */\nexport interface DeploymentComponent {\n  /**\n   * Unique component ID within the plugin.\n   */\n  id: string\n  /**\n   * False marks an optional capability; omitted means required.\n   * \n   * Optional provider/native capabilities remain visible without requiring every deployment to adopt them.\n   */\n  required?: boolean\n  /**\n   * Supported frontend/server/storage/compute capability category.\n   */\n  kind: typeof deploymentComponentKinds[number]\n  /**\n   * Declared host/container/function/database/cloud/native/external placement.\n   */\n  placement: 'host' | 'container' | 'function' | 'database' | 'cloud' | 'native' | 'external'\n  /**\n   * Optional runtime descriptor.\n   */\n  runtime?: string\n  /**\n   * Exact checksummed inventory asset references.\n   * \n   * References to files in the checksummed inventory, not arbitrary source paths.\n   */\n  assets?: string[]\n  /**\n   * Author-side asset selectors resolved by packing; unresolved patterns prevent completion.\n   * \n   * Author-side selectors resolved to exact assets by the packer; emitted inventories omit these.\n   */\n  assetPatterns?: string[]\n  /**\n   * Optional entry asset path.\n   */\n  entry?: string\n  /**\n   * Canonical schema contract IDs and semver ranges, never copied DDL.\n   * \n   * Canonical contract IDs/ranges; no copied DDL.\n   */\n  dataContracts?: Record<string, string>\n  /**\n   * Optional required tool ranges and host binding/adapter names.\n   */\n  requirements?: { \n    /**\n     * Tool-name to required-version/range map declared by the plugin.\n     */\n    tools?: Record<string, string>; \n    /**\n     * Required nonsecret host binding names; never credential values.\n     */\n    bindings?: string[]; \n    /**\n     * Required host adapter capability names.\n     */\n    adapters?: string[] }\n}\n/**\n * Declarative host-approved work and dependency ordering for deployment evidence.\n * \n * @see summarizeDeployment for canonical integration usage.\n */\nexport interface DeploymentTask {\n  /**\n   * Unique task ID within the plugin.\n   */\n  id: string\n  /**\n   * Existing components whose work this task covers.\n   */\n  componentIds: string[]\n  /**\n   * Supported build/test/provision/deploy/etc. phase.\n   */\n  action: typeof deploymentActions[number]\n  /**\n   * Artifact work is reusable; environment and tenant work require corresponding target evidence.\n   */\n  scope: 'artifact' | 'environment' | 'tenant'\n  /**\n   * Whether successful task evidence is required for completion.\n   */\n  required: boolean\n  /**\n   * Existing task IDs that must succeed before this task is considered unblocked.\n   */\n  dependsOn: string[]\n  /**\n   * Host-approved executor reference; inspection never launches it.\n   * \n   * Host-approved executor reference. Inspection never executes it or argv.\n   */\n  executor: string\n  /**\n   * Optional declarative arguments; never automatically executed by inspection.\n   */\n  argv?: string[]\n  /**\n   * Optional human operator instructions.\n   */\n  instructions?: string\n}\n/**\n * Classified deployment component/task graph for one lifecycle feature.\n * \n * @see summarizeDeployment for canonical integration usage.\n */\nexport interface DeploymentPlugin {\n  /**\n   * Plugin ID covered by the inventory lifecycle bundle.\n   */\n  id: string;\n  /**\n   * Unique deployable capability definitions.\n   */\n  components: DeploymentComponent[];\n  /**\n   * Unique work definitions forming an acyclic dependency graph.\n   */\n  tasks: DeploymentTask[] }\n/**\n * Nonsecret exact environment, physical placement and optional tenant context for scoped evidence.\n * \n * @see summarizeDeployment for canonical integration usage.\n */\nexport interface DeploymentTarget {\n  /**\n   * Nonblank deployment environment label.\n   */\n  environment: string;\n  /**\n   * Optional exact lifecycle backend ID; required for database work evidence.\n   */\n  backendId?: string;\n  /**\n   * Optional physical database identity; required with backendId for database evidence.\n   */\n  databaseId?: string;\n  /**\n   * Optional concrete tenant; required for tenant tasks and absent for environment tasks.\n   */\n  tenantId?: string }\n/**\n * Reported execution evidence bound to a task, inventory and optional destination revision.\n * \n * @see summarizeDeployment for canonical integration usage.\n */\nexport interface DeploymentResult {\n  /**\n   * Declared inventory plugin ID.\n   */\n  pluginId: string\n  /**\n   * Declared plugin task ID.\n   */\n  taskId: string\n  /**\n   * Exact environment/tenant target; absent for artifact work.\n   */\n  target?: DeploymentTarget\n  /**\n   * Reported running/succeeded/failed result; no independent execution proof is implied.\n   */\n  status: 'running' | 'succeeded' | 'failed'\n  /**\n   * Exact UTC ISO timestamp including millisecond precision; increases per task/target/placement.\n   */\n  recordedAt: string\n  /**\n   * Nonblank host/operator identity reporting the result.\n   */\n  actor: string\n  /**\n   * Nonempty distinct nonsecret evidence references, such as reviewed logs or CI receipts.\n   * \n   * Non-secret evidence references, such as a reviewed log, CI run or lifecycle plan receipt.\n   */\n  evidence: string[]\n  /**\n   * Optional explicit destination identity paired with placementSha256; forbidden for artifact results.\n   * \n   * Environment/tenant evidence bound to a reviewed component placement. Artifact results remain reusable.\n   */\n  destinationId?: string\n  /**\n   * Hash of reviewed placement/binding revisions paired with destinationId.\n   */\n  placementSha256?: string\n}\n/**\n * Operator/host-owned reported evidence journal pinned to one inventory digest.\n * \n * \n * Host/operator-owned journal. This is reported evidence, never runtime admission authority.\n * @see summarizeDeployment for canonical integration usage.\n */\nexport interface DeploymentReceipt {\n  /**\n   * Receipt discriminator; currently 1.\n   */\n  apiVersion: 1\n  /**\n   * Exact inventory owner to which these results belong.\n   */\n  owner: string\n  /**\n   * Lowercase 64-character SHA-256 of the trusted inventory bytes.\n   */\n  inventorySha256: string\n  /**\n   * Reported task outcomes in increasing per-task/target/placement timestamp order.\n   */\n  results: DeploymentResult[]\n}\n/**\n * Derived task readiness: pending, dependency-blocked, stale evidence, running, succeeded or failed.\n * \n * @see summarizeDeployment for canonical integration usage.\n */\nexport type DeploymentTaskStatus = 'pending' | 'blocked' | 'stale' | 'running' | 'succeeded' | 'failed'\n\nfunction object(value: unknown): value is Record<string, any> { return !!value && typeof value === 'object' && !Array.isArray(value) }\nfunction nonempty(value: unknown): value is string { return typeof value === 'string' && !!value.trim() && value === value.trim() }\nfunction id(value: unknown): value is string { return nonempty(value) && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value) }\nfunction strings(value: unknown, allowEmpty = true): value is string[] { return Array.isArray(value) && (allowEmpty || !!value.length) && value.every(nonempty) && new Set(value).size === value.length }\nfunction fields(value: object, allowed: string[]) { if (Object.keys(value).some(key => !allowed.includes(key))) throw new Error('Unknown deployment declaration field') }\nfunction mapping(value: unknown) { return object(value) && Object.entries(value).every(([key, v]) => nonempty(key) && nonempty(v)) }\nfunction targetKey(target?: DeploymentTarget) { return JSON.stringify([target?.environment ?? null, target?.backendId ?? null, target?.databaseId ?? null, target?.tenantId ?? null]) }\n\n/**\n * Validates declared plugin component references and task dependencies before artifact inspection.\n * \n * Validate references and the dependency DAG before artifact registration or status inspection.\n * @param inventory - Deployment inventory with checksummed asset metadata and optional per-plugin work declarations.\n * @returns The original plugin array, or undefined for legacy inventories without plugin declarations.\n * @throws Error for invalid/duplicate declarations, unsupported component/action/scope, unknown references, cycles or missing required work.\n * \n * @remarks\n * Requires explicit lifecycle-bundle coverage, known assets/components, acyclic dependencies and work for adopted components. This validates declarations without executing tasks or proving artifact file checksums.\n * \n * @example\n * ```typescript\n * import { validateDeploymentPlugins, type DeploymentInventory } from '@alneas/eaos-server/platform';\n * export function inspectDeclaration(inventory: DeploymentInventory) { return validateDeploymentPlugins(inventory); }\n * ```\n */\nexport function validateDeploymentPlugins(inventory: DeploymentInventory): DeploymentPlugin[] | undefined {\n  if (inventory.plugins === undefined) return undefined\n  if (!Array.isArray(inventory.plugins) || !inventory.plugins.length || !strings(inventory.lifecycleBundle, false)\n    || inventory.plugins.length !== inventory.lifecycleBundle.length) throw new Error('Deployment plugins must cover the lifecycle bundle')\n  const pluginIds = new Set<string>(), assets = new Set(inventory.assets.map(asset => asset.path))\n  for (const plugin of inventory.plugins) {\n    if (!object(plugin) || !id(plugin.id) || pluginIds.has(plugin.id) || !inventory.lifecycleBundle.includes(plugin.id)\n      || !Array.isArray(plugin.components) || !Array.isArray(plugin.tasks)) throw new Error('Invalid or duplicate deployment plugin')\n    fields(plugin, ['id', 'components', 'tasks'])\n    pluginIds.add(plugin.id)\n    const components = new Set<string>(), tasks = new Map<string, DeploymentTask>()\n    for (const component of plugin.components) {\n      if (!object(component) || !id(component.id) || components.has(component.id) || !deploymentComponentKinds.includes(component.kind)\n        || (component.required !== undefined && typeof component.required !== 'boolean')\n        || !['host', 'container', 'function', 'database', 'cloud', 'native', 'external'].includes(component.placement)\n        || (component.runtime !== undefined && !nonempty(component.runtime))\n        || (component.assets !== undefined && (!strings(component.assets) || component.assets.some(path => !assets.has(path))))\n        || (component.assetPatterns !== undefined && (!strings(component.assetPatterns, false) || component.assetPatterns.some(pattern => pattern.startsWith('/') || pattern.includes('\\\\') || pattern.split('/').some(part => !part || part === '.' || part === '..'))))\n        || (component.entry !== undefined && (!nonempty(component.entry) || !assets.has(component.entry)))\n        || (component.dataContracts !== undefined && !mapping(component.dataContracts))) throw new Error('Invalid deployment component or unverified asset reference')\n      fields(component, ['id', 'kind', 'required', 'placement', 'runtime', 'assets', 'assetPatterns', 'entry', 'dataContracts', 'requirements'])\n      if (component.requirements !== undefined) {\n        const req = component.requirements\n        if (!object(req) || (req.tools !== undefined && !mapping(req.tools)) || (req.bindings !== undefined && (!strings(req.bindings) || req.bindings.some(key => !/^[A-Z][A-Z0-9_]*$/.test(key))))\n          || (req.adapters !== undefined && !strings(req.adapters))) throw new Error('Invalid deployment requirements; declare references, not secret values')\n        fields(req, ['tools', 'bindings', 'adapters'])\n      }\n      components.add(component.id)\n    }\n    for (const task of plugin.tasks) {\n      if (!object(task) || !id(task.id) || tasks.has(task.id) || !strings(task.componentIds, false) || task.componentIds.some(ref => !components.has(ref))\n        || !deploymentActions.includes(task.action) || !['artifact', 'environment', 'tenant'].includes(task.scope) || typeof task.required !== 'boolean'\n        || !strings(task.dependsOn) || !nonempty(task.executor) || (task.argv !== undefined && (!Array.isArray(task.argv) || !task.argv.length || task.argv.some(arg => typeof arg !== 'string')))\n        || (task.instructions !== undefined && !nonempty(task.instructions))) throw new Error('Invalid deployment task or component reference')\n      fields(task, ['id', 'componentIds', 'action', 'scope', 'required', 'dependsOn', 'executor', 'argv', 'instructions'])\n      if (task.scope === 'artifact' && !['build', 'test', 'verify'].includes(task.action)) throw new Error('Environment-changing work cannot have artifact scope')\n      tasks.set(task.id, task)\n    }\n    const visiting = new Set<string>(), visited = new Set<string>(), scopeRank = { artifact: 0, environment: 1, tenant: 2 }\n    const visit = (task: DeploymentTask) => {\n      if (visiting.has(task.id)) throw new Error('Cyclic deployment task dependency')\n      if (visited.has(task.id)) return\n      visiting.add(task.id)\n      for (const ref of task.dependsOn) {\n        const dependency = tasks.get(ref)\n        if (!dependency) throw new Error('Unknown deployment task dependency')\n        if (scopeRank[dependency.scope] > scopeRank[task.scope]) throw new Error('Deployment dependency has a narrower target scope')\n        visit(dependency)\n      }\n      visiting.delete(task.id); visited.add(task.id)\n    }\n    for (const task of tasks.values()) visit(task)\n    if (plugin.components.some(component => !plugin.tasks.some(task => (component.required === false || task.required) && task.componentIds.includes(component.id)))) throw new Error('Every required deployment component requires at least one required task; optional components still require declared work')\n    if (!components.size && tasks.size) throw new Error('Tasks require deployment components')\n  }\n  return inventory.plugins\n}\n\n/**\n * Validates the exact nonsecret environment/backend/database/tenant target shape.\n * @param value - Untrusted target object with a nonblank environment and optional nonblank identity references.\n * @returns Completes without a value and narrows the input to DeploymentTarget.\n * @throws Error for missing/blank identity fields or unknown target properties.\n * \n * @remarks\n * Does not resolve backend existence, tenant membership or deployment authority.\n * \n * @example\n * ```typescript\n * import { validateDeploymentTarget } from '@alneas/eaos-server/platform/deployment';\n * const target: unknown = { environment: 'review' };\n * validateDeploymentTarget(target);\n * ```\n */\nexport function validateDeploymentTarget(value: unknown): asserts value is DeploymentTarget {\n  if (!object(value) || !nonempty(value.environment) || ['backendId', 'databaseId', 'tenantId'].some(key => value[key] !== undefined && !nonempty(value[key]))) throw new Error('Invalid deployment target')\n  fields(value, ['environment', 'backendId', 'databaseId', 'tenantId'])\n}\n/**\n * Validates version-1 reported task evidence and strictly increasing timestamps per task/target/placement.\n * @param value - Untrusted receipt with owner, pinned inventory SHA-256 and task result records.\n * @returns Completes without a value and narrows the input to DeploymentReceipt.\n * @throws Error for malformed/extra fields, invalid hashes/timestamps, missing evidence or nonincreasing repeated-result timestamps.\n * \n * @remarks\n * Each result needs a UTC millisecond ISO timestamp, actor and nonempty distinct evidence references. destinationId and placementSha256 must occur together. This validates shape/order only; it does not independently verify evidence or grant runtime admission.\n * \n * @example\n * ```typescript\n * import { validateDeploymentReceipt } from '@alneas/eaos-server/platform/deployment';\n * const receipt: unknown = { apiVersion: 1, owner: 'reports', inventorySha256: 'a'.repeat(64), results: [] };\n * validateDeploymentReceipt(receipt);\n * ```\n */\nexport function validateDeploymentReceipt(value: unknown): asserts value is DeploymentReceipt {\n  if (!object(value) || value.apiVersion !== 1 || !nonempty(value.owner) || typeof value.inventorySha256 !== 'string' || !/^[a-f0-9]{64}$/.test(value.inventorySha256) || !Array.isArray(value.results)) throw new Error('Invalid deployment receipt')\n  fields(value, ['apiVersion', 'owner', 'inventorySha256', 'results'])\n  const times = new Map<string, number>()\n  for (const result of value.results) {\n    if (!object(result) || !id(result.pluginId) || !id(result.taskId) || !['running', 'succeeded', 'failed'].includes(result.status)\n      || !nonempty(result.actor) || !strings(result.evidence, false) || !nonempty(result.recordedAt)\n      || !/^\\d{4}-\\d\\d-\\d\\dT\\d\\d:\\d\\d:\\d\\d\\.\\d{3}Z$/.test(result.recordedAt) || !Number.isFinite(Date.parse(result.recordedAt))\n      || new Date(result.recordedAt).toISOString() !== result.recordedAt) throw new Error('Invalid deployment result; actor, timestamp and evidence are required')\n    fields(result, ['pluginId', 'taskId', 'target', 'status', 'recordedAt', 'actor', 'evidence', 'destinationId', 'placementSha256'])\n    if ((result.destinationId === undefined) !== (result.placementSha256 === undefined) || (result.destinationId !== undefined && (!id(result.destinationId) || !/^[a-f0-9]{64}$/.test(result.placementSha256!)))) throw Error('Placement evidence requires destinationId and placementSha256')\n    if (result.target !== undefined) validateDeploymentTarget(result.target)\n    const key = JSON.stringify([result.pluginId, result.taskId, targetKey(result.target), result.destinationId ?? null, result.placementSha256 ?? null])\n    const time = Date.parse(result.recordedAt)\n    if (time <= (times.get(key) ?? -Infinity)) throw new Error('Deployment result timestamps must increase for each task/target')\n    times.set(key, time)\n  }\n}\nfunction taskTarget(task: DeploymentTask, target?: DeploymentTarget): DeploymentTarget | undefined {\n  if (task.scope === 'artifact') return undefined\n  if (!target || (task.scope === 'tenant' && !target.tenantId)) return undefined\n  const { tenantId: _tenantId, ...environment } = target\n  return task.scope === 'tenant' ? target : environment\n}\n\n/**\n * Aggregates host/operator task evidence into dependency-aware plugin and component completion states.\n * \n * Aggregate operator/host evidence only. A build receipt cannot complete DB/infra/deployment tasks.\n * @param inventory - Validated artifact declaration; missing plugins remains legacy-unclassified.\n * @param inventorySha256 - Trusted lowercase 64-character inventory digest.\n * @param receipts - Reported receipts; defaults to none.\n * @param target - Optional current environment/backend/database/tenant context for scoped work.\n * @returns A read-only summary with coverage, artifact resolution, task states and ignored owner/stale-inventory/placement receipts.\n * @throws Error for invalid declarations/receipts/hash/target, undeclared tasks, scope mismatch or conflicting equal-time evidence.\n * \n * @remarks\n * No task executes. Artifact work is reusable; environment/tenant evidence must match scope and database work needs explicit backend/database identities. Newer dependency evidence makes older success stale. Completion is host-reported evidence, never admission authority.\n * \n * @example\n * ```typescript\n * import { summarizeDeployment, type DeploymentInventory, type DeploymentReceipt, type DeploymentTarget } from '@alneas/eaos-server/platform';\n * export function inspect(inventory: DeploymentInventory, digest: string, receipts: DeploymentReceipt[], target?: DeploymentTarget) { return summarizeDeployment(inventory, digest, receipts, target); }\n * ```\n */\nexport function summarizeDeployment(inventory: DeploymentInventory, inventorySha256: string, receipts: DeploymentReceipt[] = [], target?: DeploymentTarget) {\n  if (!/^[a-f0-9]{64}$/.test(inventorySha256)) throw new Error('Invalid inventory SHA-256')\n  const plugins = validateDeploymentPlugins(inventory)\n  if (target !== undefined) validateDeploymentTarget(target)\n  const results = new Map<string, DeploymentResult>(), ignoredReceipts: Array<{ owner: string; reason: string }> = []\n  for (const receipt of receipts) {\n    validateDeploymentReceipt(receipt)\n    if (receipt.owner !== inventory.owner || receipt.inventorySha256 !== inventorySha256) {\n      ignoredReceipts.push({ owner: receipt.owner, reason: receipt.owner !== inventory.owner ? 'different-owner' : 'stale-inventory' }); continue\n    }\n    for (const result of receipt.results) {\n      const task = plugins?.find(plugin => plugin.id === result.pluginId)?.tasks.find(task => task.id === result.taskId)\n      if (!task) throw new Error('Receipt references an undeclared deployment task')\n      if (result.destinationId !== undefined) {\n        if (task.scope === 'artifact') throw Error('Artifact evidence must not be bound to a destination')\n        ignoredReceipts.push({ owner: receipt.owner, reason: 'placement-context-required' }); continue\n      }\n      if ((task.scope === 'artifact' && result.target !== undefined) || (task.scope !== 'artifact' && !result.target)\n        || (task.scope === 'environment' && result.target?.tenantId !== undefined) || (task.scope === 'tenant' && !result.target?.tenantId)) throw new Error('Receipt target does not match task scope')\n      const plugin = plugins!.find(plugin => plugin.id === result.pluginId)!\n      if (task.scope !== 'artifact' && plugin.components.some(component => component.kind === 'database' && task.componentIds.includes(component.id))\n        && (!result.target?.backendId || !result.target.databaseId)) throw new Error('Database work requires explicit backendId and databaseId evidence')\n      const expected = taskTarget(task, target)\n      if ((task.scope !== 'artifact' && !expected) || targetKey(result.target) !== targetKey(expected)) continue\n      const key = JSON.stringify([result.pluginId, result.taskId]), old = results.get(key)\n      if (old && old.recordedAt === result.recordedAt && JSON.stringify(old) !== JSON.stringify(result)) throw new Error('Conflicting deployment results at the same timestamp')\n      if (!old || old.recordedAt < result.recordedAt) results.set(key, result)\n    }\n  }\n  const summaries = (plugins ?? []).map(plugin => {\n    const artifactResolved = !plugin.components.some(component => component.assetPatterns?.length)\n    const states = new Map<string, { status: DeploymentTaskStatus; result?: DeploymentResult }>()\n    const status = (task: DeploymentTask): { status: DeploymentTaskStatus; result?: DeploymentResult } => {\n      const known = states.get(task.id)\n      if (known) return known\n      const result = results.get(JSON.stringify([plugin.id, task.id]))\n      const dependencies = task.dependsOn.map(ref => status(plugin.tasks.find(task => task.id === ref)!))\n      const blocked = dependencies.some(dependency => dependency.status !== 'succeeded')\n      const stale = result?.status === 'succeeded' && dependencies.some(dependency => dependency.result && dependency.result.recordedAt > result.recordedAt)\n      const state = { status: (blocked ? 'blocked' : stale ? 'stale' : result?.status ?? 'pending') as DeploymentTaskStatus, result }\n      states.set(task.id, state); return state\n    }\n    const tasks = plugin.tasks.map(task => ({ ...task, ...status(task) }))\n    return { id: plugin.id, artifactResolved, complete: artifactResolved && tasks.filter(task => task.required).every(task => task.status === 'succeeded'),\n      components: plugin.components.map(component => ({ ...component, complete: artifactResolved && tasks.filter(task => (component.required === false || task.required) && task.componentIds.includes(component.id)).every(task => task.status === 'succeeded') })), tasks }\n  })\n  return { owner: inventory.owner, inventorySha256, target, coverage: plugins ? 'declared' as const : 'legacy-unclassified' as const,\n    artifactResolved: !!plugins && summaries.every(plugin => plugin.artifactResolved), complete: !!plugins && summaries.every(plugin => plugin.complete), plugins: summaries, ignoredReceipts,\n    evidencePolicy: 'Operator/host-reported evidence; not independent verification or runtime authorization' }\n}\n"],"mappings":";AAOO,IAAM,2BAA2B,CAAC,YAAY,OAAO,OAAO,WAAW,YAAY,UAAU,OAAO,WAAW,YAAY,YAAY,kBAAkB,WAAW,SAAS,SAAS,UAAU,eAAe,UAAU,SAAS,aAAa;AAM/O,IAAM,oBAAoB,CAAC,SAAS,QAAQ,WAAW,aAAa,aAAa,WAAW,UAAU,UAAU,UAAU,QAAQ;AAwOzI,SAAS,OAAO,OAA8C;AAAE,SAAO,CAAC,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAAE;AACrI,SAAS,SAAS,OAAiC;AAAE,SAAO,OAAO,UAAU,YAAY,CAAC,CAAC,MAAM,KAAK,KAAK,UAAU,MAAM,KAAK;AAAE;AAClI,SAAS,GAAG,OAAiC;AAAE,SAAO,SAAS,KAAK,KAAK,+BAA+B,KAAK,KAAK;AAAE;AACpH,SAAS,QAAQ,OAAgB,aAAa,MAAyB;AAAE,SAAO,MAAM,QAAQ,KAAK,MAAM,cAAc,CAAC,CAAC,MAAM,WAAW,MAAM,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AAAO;AACxM,SAAS,OAAO,OAAe,SAAmB;AAAE,MAAI,OAAO,KAAK,KAAK,EAAE,KAAK,SAAO,CAAC,QAAQ,SAAS,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,sCAAsC;AAAE;AACxK,SAAS,QAAQ,OAAgB;AAAE,SAAO,OAAO,KAAK,KAAK,OAAO,QAAQ,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,GAAG,KAAK,SAAS,CAAC,CAAC;AAAE;AACnI,SAAS,UAAU,QAA2B;AAAE,SAAO,KAAK,UAAU,CAAC,QAAQ,eAAe,MAAM,QAAQ,aAAa,MAAM,QAAQ,cAAc,MAAM,QAAQ,YAAY,IAAI,CAAC;AAAE;AAmB/K,SAAS,0BAA0B,WAAgE;AACxG,MAAI,UAAU,YAAY,OAAW,QAAO;AAC5C,MAAI,CAAC,MAAM,QAAQ,UAAU,OAAO,KAAK,CAAC,UAAU,QAAQ,UAAU,CAAC,QAAQ,UAAU,iBAAiB,KAAK,KAC1G,UAAU,QAAQ,WAAW,UAAU,gBAAgB,OAAQ,OAAM,IAAI,MAAM,oDAAoD;AACxI,QAAM,YAAY,oBAAI,IAAY,GAAG,SAAS,IAAI,IAAI,UAAU,OAAO,IAAI,WAAS,MAAM,IAAI,CAAC;AAC/F,aAAW,UAAU,UAAU,SAAS;AACtC,QAAI,CAAC,OAAO,MAAM,KAAK,CAAC,GAAG,OAAO,EAAE,KAAK,UAAU,IAAI,OAAO,EAAE,KAAK,CAAC,UAAU,gBAAgB,SAAS,OAAO,EAAE,KAC7G,CAAC,MAAM,QAAQ,OAAO,UAAU,KAAK,CAAC,MAAM,QAAQ,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,wCAAwC;AAChI,WAAO,QAAQ,CAAC,MAAM,cAAc,OAAO,CAAC;AAC5C,cAAU,IAAI,OAAO,EAAE;AACvB,UAAM,aAAa,oBAAI,IAAY,GAAG,QAAQ,oBAAI,IAA4B;AAC9E,eAAW,aAAa,OAAO,YAAY;AACzC,UAAI,CAAC,OAAO,SAAS,KAAK,CAAC,GAAG,UAAU,EAAE,KAAK,WAAW,IAAI,UAAU,EAAE,KAAK,CAAC,yBAAyB,SAAS,UAAU,IAAI,KAC1H,UAAU,aAAa,UAAa,OAAO,UAAU,aAAa,aACnE,CAAC,CAAC,QAAQ,aAAa,YAAY,YAAY,SAAS,UAAU,UAAU,EAAE,SAAS,UAAU,SAAS,KACzG,UAAU,YAAY,UAAa,CAAC,SAAS,UAAU,OAAO,KAC9D,UAAU,WAAW,WAAc,CAAC,QAAQ,UAAU,MAAM,KAAK,UAAU,OAAO,KAAK,UAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,MAChH,UAAU,kBAAkB,WAAc,CAAC,QAAQ,UAAU,eAAe,KAAK,KAAK,UAAU,cAAc,KAAK,aAAW,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,IAAI,KAAK,QAAQ,MAAM,GAAG,EAAE,KAAK,UAAQ,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,CAAC,MAC1P,UAAU,UAAU,WAAc,CAAC,SAAS,UAAU,KAAK,KAAK,CAAC,OAAO,IAAI,UAAU,KAAK,MAC3F,UAAU,kBAAkB,UAAa,CAAC,QAAQ,UAAU,aAAa,EAAI,OAAM,IAAI,MAAM,4DAA4D;AAC/J,aAAO,WAAW,CAAC,MAAM,QAAQ,YAAY,aAAa,WAAW,UAAU,iBAAiB,SAAS,iBAAiB,cAAc,CAAC;AACzI,UAAI,UAAU,iBAAiB,QAAW;AACxC,cAAM,MAAM,UAAU;AACtB,YAAI,CAAC,OAAO,GAAG,KAAM,IAAI,UAAU,UAAa,CAAC,QAAQ,IAAI,KAAK,KAAO,IAAI,aAAa,WAAc,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,SAAS,KAAK,SAAO,CAAC,oBAAoB,KAAK,GAAG,CAAC,MACnL,IAAI,aAAa,UAAa,CAAC,QAAQ,IAAI,QAAQ,EAAI,OAAM,IAAI,MAAM,wEAAwE;AACrJ,eAAO,KAAK,CAAC,SAAS,YAAY,UAAU,CAAC;AAAA,MAC/C;AACA,iBAAW,IAAI,UAAU,EAAE;AAAA,IAC7B;AACA,eAAW,QAAQ,OAAO,OAAO;AAC/B,UAAI,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,KAAK,MAAM,IAAI,KAAK,EAAE,KAAK,CAAC,QAAQ,KAAK,cAAc,KAAK,KAAK,KAAK,aAAa,KAAK,SAAO,CAAC,WAAW,IAAI,GAAG,CAAC,KAC9I,CAAC,kBAAkB,SAAS,KAAK,MAAM,KAAK,CAAC,CAAC,YAAY,eAAe,QAAQ,EAAE,SAAS,KAAK,KAAK,KAAK,OAAO,KAAK,aAAa,aACpI,CAAC,QAAQ,KAAK,SAAS,KAAK,CAAC,SAAS,KAAK,QAAQ,KAAM,KAAK,SAAS,WAAc,CAAC,MAAM,QAAQ,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,KAAK,KAAK,KAAK,SAAO,OAAO,QAAQ,QAAQ,MACnL,KAAK,iBAAiB,UAAa,CAAC,SAAS,KAAK,YAAY,EAAI,OAAM,IAAI,MAAM,gDAAgD;AACxI,aAAO,MAAM,CAAC,MAAM,gBAAgB,UAAU,SAAS,YAAY,aAAa,YAAY,QAAQ,cAAc,CAAC;AACnH,UAAI,KAAK,UAAU,cAAc,CAAC,CAAC,SAAS,QAAQ,QAAQ,EAAE,SAAS,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAC3J,YAAM,IAAI,KAAK,IAAI,IAAI;AAAA,IACzB;AACA,UAAM,WAAW,oBAAI,IAAY,GAAG,UAAU,oBAAI,IAAY,GAAG,YAAY,EAAE,UAAU,GAAG,aAAa,GAAG,QAAQ,EAAE;AACtH,UAAM,QAAQ,CAAC,SAAyB;AACtC,UAAI,SAAS,IAAI,KAAK,EAAE,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAC9E,UAAI,QAAQ,IAAI,KAAK,EAAE,EAAG;AAC1B,eAAS,IAAI,KAAK,EAAE;AACpB,iBAAW,OAAO,KAAK,WAAW;AAChC,cAAM,aAAa,MAAM,IAAI,GAAG;AAChC,YAAI,CAAC,WAAY,OAAM,IAAI,MAAM,oCAAoC;AACrE,YAAI,UAAU,WAAW,KAAK,IAAI,UAAU,KAAK,KAAK,EAAG,OAAM,IAAI,MAAM,mDAAmD;AAC5H,cAAM,UAAU;AAAA,MAClB;AACA,eAAS,OAAO,KAAK,EAAE;AAAG,cAAQ,IAAI,KAAK,EAAE;AAAA,IAC/C;AACA,eAAW,QAAQ,MAAM,OAAO,EAAG,OAAM,IAAI;AAC7C,QAAI,OAAO,WAAW,KAAK,eAAa,CAAC,OAAO,MAAM,KAAK,WAAS,UAAU,aAAa,SAAS,KAAK,aAAa,KAAK,aAAa,SAAS,UAAU,EAAE,CAAC,CAAC,EAAG,OAAM,IAAI,MAAM,0HAA0H;AAC5S,QAAI,CAAC,WAAW,QAAQ,MAAM,KAAM,OAAM,IAAI,MAAM,qCAAqC;AAAA,EAC3F;AACA,SAAO,UAAU;AACnB;AAkBO,SAAS,yBAAyB,OAAmD;AAC1F,MAAI,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,MAAM,WAAW,KAAK,CAAC,aAAa,cAAc,UAAU,EAAE,KAAK,SAAO,MAAM,GAAG,MAAM,UAAa,CAAC,SAAS,MAAM,GAAG,CAAC,CAAC,EAAG,OAAM,IAAI,MAAM,2BAA2B;AACzM,SAAO,OAAO,CAAC,eAAe,aAAa,cAAc,UAAU,CAAC;AACtE;AAiBO,SAAS,0BAA0B,OAAoD;AAC5F,MAAI,CAAC,OAAO,KAAK,KAAK,MAAM,eAAe,KAAK,CAAC,SAAS,MAAM,KAAK,KAAK,OAAO,MAAM,oBAAoB,YAAY,CAAC,iBAAiB,KAAK,MAAM,eAAe,KAAK,CAAC,MAAM,QAAQ,MAAM,OAAO,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACnP,SAAO,OAAO,CAAC,cAAc,SAAS,mBAAmB,SAAS,CAAC;AACnE,QAAM,QAAQ,oBAAI,IAAoB;AACtC,aAAW,UAAU,MAAM,SAAS;AAClC,QAAI,CAAC,OAAO,MAAM,KAAK,CAAC,GAAG,OAAO,QAAQ,KAAK,CAAC,GAAG,OAAO,MAAM,KAAK,CAAC,CAAC,WAAW,aAAa,QAAQ,EAAE,SAAS,OAAO,MAAM,KAC1H,CAAC,SAAS,OAAO,KAAK,KAAK,CAAC,QAAQ,OAAO,UAAU,KAAK,KAAK,CAAC,SAAS,OAAO,UAAU,KAC1F,CAAC,2CAA2C,KAAK,OAAO,UAAU,KAAK,CAAC,OAAO,SAAS,KAAK,MAAM,OAAO,UAAU,CAAC,KACrH,IAAI,KAAK,OAAO,UAAU,EAAE,YAAY,MAAM,OAAO,WAAY,OAAM,IAAI,MAAM,uEAAuE;AAC7J,WAAO,QAAQ,CAAC,YAAY,UAAU,UAAU,UAAU,cAAc,SAAS,YAAY,iBAAiB,iBAAiB,CAAC;AAChI,QAAK,OAAO,kBAAkB,YAAgB,OAAO,oBAAoB,WAAe,OAAO,kBAAkB,WAAc,CAAC,GAAG,OAAO,aAAa,KAAK,CAAC,iBAAiB,KAAK,OAAO,eAAgB,GAAK,OAAM,MAAM,+DAA+D;AAC1R,QAAI,OAAO,WAAW,OAAW,0BAAyB,OAAO,MAAM;AACvE,UAAM,MAAM,KAAK,UAAU,CAAC,OAAO,UAAU,OAAO,QAAQ,UAAU,OAAO,MAAM,GAAG,OAAO,iBAAiB,MAAM,OAAO,mBAAmB,IAAI,CAAC;AACnJ,UAAM,OAAO,KAAK,MAAM,OAAO,UAAU;AACzC,QAAI,SAAS,MAAM,IAAI,GAAG,KAAK,WAAY,OAAM,IAAI,MAAM,iEAAiE;AAC5H,UAAM,IAAI,KAAK,IAAI;AAAA,EACrB;AACF;AACA,SAAS,WAAW,MAAsB,QAAyD;AACjG,MAAI,KAAK,UAAU,WAAY,QAAO;AACtC,MAAI,CAAC,UAAW,KAAK,UAAU,YAAY,CAAC,OAAO,SAAW,QAAO;AACrE,QAAM,EAAE,UAAU,WAAW,GAAG,YAAY,IAAI;AAChD,SAAO,KAAK,UAAU,WAAW,SAAS;AAC5C;AAsBO,SAAS,oBAAoB,WAAgC,iBAAyB,WAAgC,CAAC,GAAG,QAA2B;AAC1J,MAAI,CAAC,iBAAiB,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,2BAA2B;AACxF,QAAM,UAAU,0BAA0B,SAAS;AACnD,MAAI,WAAW,OAAW,0BAAyB,MAAM;AACzD,QAAM,UAAU,oBAAI,IAA8B,GAAG,kBAA4D,CAAC;AAClH,aAAW,WAAW,UAAU;AAC9B,8BAA0B,OAAO;AACjC,QAAI,QAAQ,UAAU,UAAU,SAAS,QAAQ,oBAAoB,iBAAiB;AACpF,sBAAgB,KAAK,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,UAAU,UAAU,QAAQ,oBAAoB,kBAAkB,CAAC;AAAG;AAAA,IACrI;AACA,eAAW,UAAU,QAAQ,SAAS;AACpC,YAAM,OAAO,SAAS,KAAK,CAAAA,YAAUA,QAAO,OAAO,OAAO,QAAQ,GAAG,MAAM,KAAK,CAAAC,UAAQA,MAAK,OAAO,OAAO,MAAM;AACjH,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,kDAAkD;AAC7E,UAAI,OAAO,kBAAkB,QAAW;AACtC,YAAI,KAAK,UAAU,WAAY,OAAM,MAAM,sDAAsD;AACjG,wBAAgB,KAAK,EAAE,OAAO,QAAQ,OAAO,QAAQ,6BAA6B,CAAC;AAAG;AAAA,MACxF;AACA,UAAK,KAAK,UAAU,cAAc,OAAO,WAAW,UAAe,KAAK,UAAU,cAAc,CAAC,OAAO,UAClG,KAAK,UAAU,iBAAiB,OAAO,QAAQ,aAAa,UAAe,KAAK,UAAU,YAAY,CAAC,OAAO,QAAQ,SAAW,OAAM,IAAI,MAAM,0CAA0C;AACjM,YAAM,SAAS,QAAS,KAAK,CAAAD,YAAUA,QAAO,OAAO,OAAO,QAAQ;AACpE,UAAI,KAAK,UAAU,cAAc,OAAO,WAAW,KAAK,eAAa,UAAU,SAAS,cAAc,KAAK,aAAa,SAAS,UAAU,EAAE,CAAC,MACxI,CAAC,OAAO,QAAQ,aAAa,CAAC,OAAO,OAAO,YAAa,OAAM,IAAI,MAAM,mEAAmE;AAClJ,YAAM,WAAW,WAAW,MAAM,MAAM;AACxC,UAAK,KAAK,UAAU,cAAc,CAAC,YAAa,UAAU,OAAO,MAAM,MAAM,UAAU,QAAQ,EAAG;AAClG,YAAM,MAAM,KAAK,UAAU,CAAC,OAAO,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,IAAI,GAAG;AACnF,UAAI,OAAO,IAAI,eAAe,OAAO,cAAc,KAAK,UAAU,GAAG,MAAM,KAAK,UAAU,MAAM,EAAG,OAAM,IAAI,MAAM,sDAAsD;AACzK,UAAI,CAAC,OAAO,IAAI,aAAa,OAAO,WAAY,SAAQ,IAAI,KAAK,MAAM;AAAA,IACzE;AAAA,EACF;AACA,QAAM,aAAa,WAAW,CAAC,GAAG,IAAI,YAAU;AAC9C,UAAM,mBAAmB,CAAC,OAAO,WAAW,KAAK,eAAa,UAAU,eAAe,MAAM;AAC7F,UAAM,SAAS,oBAAI,IAAyE;AAC5F,UAAM,SAAS,CAAC,SAAsF;AACpG,YAAM,QAAQ,OAAO,IAAI,KAAK,EAAE;AAChC,UAAI,MAAO,QAAO;AAClB,YAAM,SAAS,QAAQ,IAAI,KAAK,UAAU,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;AAC/D,YAAM,eAAe,KAAK,UAAU,IAAI,SAAO,OAAO,OAAO,MAAM,KAAK,CAAAC,UAAQA,MAAK,OAAO,GAAG,CAAE,CAAC;AAClG,YAAM,UAAU,aAAa,KAAK,gBAAc,WAAW,WAAW,WAAW;AACjF,YAAM,QAAQ,QAAQ,WAAW,eAAe,aAAa,KAAK,gBAAc,WAAW,UAAU,WAAW,OAAO,aAAa,OAAO,UAAU;AACrJ,YAAM,QAAQ,EAAE,QAAS,UAAU,YAAY,QAAQ,UAAU,QAAQ,UAAU,WAAoC,OAAO;AAC9H,aAAO,IAAI,KAAK,IAAI,KAAK;AAAG,aAAO;AAAA,IACrC;AACA,UAAM,QAAQ,OAAO,MAAM,IAAI,WAAS,EAAE,GAAG,MAAM,GAAG,OAAO,IAAI,EAAE,EAAE;AACrE,WAAO;AAAA,MAAE,IAAI,OAAO;AAAA,MAAI;AAAA,MAAkB,UAAU,oBAAoB,MAAM,OAAO,UAAQ,KAAK,QAAQ,EAAE,MAAM,UAAQ,KAAK,WAAW,WAAW;AAAA,MACnJ,YAAY,OAAO,WAAW,IAAI,gBAAc,EAAE,GAAG,WAAW,UAAU,oBAAoB,MAAM,OAAO,WAAS,UAAU,aAAa,SAAS,KAAK,aAAa,KAAK,aAAa,SAAS,UAAU,EAAE,CAAC,EAAE,MAAM,UAAQ,KAAK,WAAW,WAAW,EAAE,EAAE;AAAA,MAAG;AAAA,IAAM;AAAA,EAC1Q,CAAC;AACD,SAAO;AAAA,IAAE,OAAO,UAAU;AAAA,IAAO;AAAA,IAAiB;AAAA,IAAQ,UAAU,UAAU,aAAsB;AAAA,IAClG,kBAAkB,CAAC,CAAC,WAAW,UAAU,MAAM,YAAU,OAAO,gBAAgB;AAAA,IAAG,UAAU,CAAC,CAAC,WAAW,UAAU,MAAM,YAAU,OAAO,QAAQ;AAAA,IAAG,SAAS;AAAA,IAAW;AAAA,IAC1K,gBAAgB;AAAA,EAAyF;AAC7G;","names":["plugin","task"]}